EUVD-2025-17513CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo allows PHP Local File Inclusion. This issue affects Revo: from n/a through 4.0.26.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in magentech Revo versions up to 4.0.26 that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. An attacker can exploit this to read sensitive files, execute code, or compromise the affected system; the vulnerability requires user interaction (UI:R) but carries high impact across confidentiality, integrity, and availability. While no public exploit code or KEV status is currently confirmed in available intelligence, the combination of network accessibility, high CVSS score (7.5), and file inclusion primitives makes this a notable risk for unpatched Revo installations.
Technical ContextAI
This vulnerability exploits a classic PHP file inclusion flaw rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The affected magentech Revo application (an OpenCart-based e-commerce platform) fails to properly sanitize user-supplied input before passing it to PHP's include(), require(), include_once(), or require_once() functions. The underlying mechanism allows attackers to manipulate file path parameters—typically in GET or POST parameters—to reference files outside the intended directory structure. In LFI contexts, this enables reading of /etc/passwd, configuration files containing credentials, application source code, or log files. If combined with file upload functions or log poisoning, LFI can escalate to Remote Code Execution (RCE). The CWE-98 classification indicates the root cause is insufficient input validation and allowlist/blocklist failures on file references.
RemediationAI
- Immediate patching: Update magentech Revo to version 4.0.27 or later (assuming the next release after 4.0.26 contains the fix; verify with magentech's official advisory). 2. Workarounds pending patch: Implement strict input validation on all file path parameters—maintain an allowlist of permissible file paths and reject any input deviating from expected patterns. Use PHP's basename() function to strip directory traversal sequences, and employ realpath() to validate that resolved paths remain within safe directories. 3. Web Application Firewall (WAF) rules: Deploy WAF signatures to block common LFI payloads (e.g., patterns containing ../, %2e%2e%2f, or null bytes). 4. Least privilege: Run the PHP application (Apache/Nginx) under a low-privilege user account to limit the scope of file access. 5. Disable dangerous PHP functions: Disable allow_url_include and allow_url_fopen in php.ini to prevent remote file inclusion vectors. 6. Monitor logs: Audit access logs for suspicious file path parameters and evidence of exploitation attempts. 7. Vendor advisory: Check magentech's official support site or security advisories for patched version details and deployment instructions.
Share
External POC / Exploit Code
Leaving vuln.today